(tooling-gofannon) 02/04: bedrock-mythos: profile-aware STS session + awscrt dep

[ak...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

andrewmusselman pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-gofannon.git

commit 4811cda627338cd67663efa46d2a818da2630eca
Author: Andrew Musselman <ak...@apache.org>
AuthorDate: Mon Jun 8 16:40:25 2026 -0700

    bedrock-mythos: profile-aware STS session + awscrt dep
    
    Local dev compose stack sets AWS_ACCESS_KEY_ID/SECRET to MinIO test
    creds (minioadmin) for S3 development workflows. boto3's default
    credential chain checks env vars before profiles, so the STS call
    would pick up minioadmin and fail. By creating the session from an
    explicit profile when AWS_PROFILE is in env, we bypass the env-var
    creds in dev. In prod no profile is set; the else branch runs and
    the default chain finds the EC2 instance role via IMDS.
    
    requirements: add awscrt — botocore's login credential provider
    (used when devs sign in via 'aws login') requires the AWS Common
    Runtime native library. Without it boto3 raises
    MissingDependencyException when anything in the container uses the
    AWS_PROFILE-mapped login_session. Harmless in prod where the path
    isn't exercised.
---
 webapp/packages/api/user-service/requirements.txt        |  1 +
 webapp/packages/api/user-service/services/llm_service.py | 10 +++++++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/webapp/packages/api/user-service/requirements.txt b/webapp/packages/api/user-service/requirements.txt
index 8f57c72..0011382 100644
--- a/webapp/packages/api/user-service/requirements.txt
+++ b/webapp/packages/api/user-service/requirements.txt
@@ -24,3 +24,4 @@ a2wsgi
 google-cloud-logging
 ldap3>=2.9
 aws-bedrock-token-generator>=1.0
+awscrt>=0.20
diff --git a/webapp/packages/api/user-service/services/llm_service.py b/webapp/packages/api/user-service/services/llm_service.py
index 1fc2e20..3688644 100644
--- a/webapp/packages/api/user-service/services/llm_service.py
+++ b/webapp/packages/api/user-service/services/llm_service.py
@@ -110,9 +110,13 @@ def _get_bedrock_mythos_api_key(
         if (cached["_expires_at"] - now).total_seconds() > _TOKEN_REFRESH_MARGIN_SECONDS:
             return cached["token"]
 
-    # Assume the cross-account role using whatever credentials are
-    # ambient (EC2 instance profile in prod, aws login locally).
-    sts = boto3.client("sts")
+    # Pick a session that ignores env-var credentials when AWS_PROFILE
+    # is set, so dev environments with minioadmin/etc. baked in don't
+    # poison the STS call. Default chain (EC2 instance role via IMDS)
+    # is used in prod where no profile is set.
+    profile = os.environ.get("AWS_PROFILE")
+    session = boto3.Session(profile_name=profile) if profile else boto3.Session()
+    sts = session.client("sts")
     response = sts.assume_role(
         RoleArn=assume_role_arn,
         RoleSessionName="gofannon-bedrock-mythos",


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org